4 ms·
> username/password can get harvested in lots of ways, BasicAuth isn't more at risk of this than other methods however. Unless a website doesn't use HTTPS, but
by usrbinbash 5y ago
> username/password can get harvested in lots of ways,
BasicAuth isn't more at risk of this than other methods however. Unless a website doesn't use HTTPS, but if that's the case, all talk about security is out the window anyway.
> The way I've seen browsers implement password auth generally blocks interacting with the rest of the page.
BasicAuth Challenge -> Wrong Password -> Server replies with 200 + "Did you forget your password klick here ..." page instead of 401. There, pwd recovery system implemented using BasicAuth.
- yuliyp 5y agoMy comment about username/password being harvested was talking about how someone's password can get stolen: you can have malware, password reuse across sites, phishing, or other social engineering. For session cookies, you have basically malware as the compromise vector. Hence, passwords should be treated with more suspicion by an authentication system.
- usrbinbash 5y agoAll these attack vectors work regardless of the Authentication system used.
- yuliyp 5y agoThey don't, though. Users don't reuse session cookies between sites, so another site compromised doesn't mean you have to worry about existing sessions being compromised on your site. Users also don't know their session cookies so are far less likely to go typing them in to a phishing site or hand them out over the phone. A password is vulnerable to all of these scenarios.